]>
Commit | Line | Data |
---|---|---|
846e33c7 | 1 | /* |
3c95ef22 | 2 | * Copyright 2014-2023 The OpenSSL Project Authors. All Rights Reserved. |
ecf4d660 | 3 | * |
2c18d164 | 4 | * Licensed under the Apache License 2.0 (the "License"). You may not use |
846e33c7 RS |
5 | * this file except in compliance with the License. You can obtain a copy |
6 | * in the file LICENSE in the source distribution or at | |
7 | * https://www.openssl.org/source/license.html | |
ecf4d660 DSH |
8 | */ |
9 | ||
10 | /* Custom extension utility functions */ | |
11 | ||
3c27208f | 12 | #include <openssl/ct.h> |
706457b7 | 13 | #include "../ssl_local.h" |
67dc995e | 14 | #include "internal/cryptlib.h" |
706457b7 | 15 | #include "statem_local.h" |
ecf4d660 | 16 | |
43ae5eed MC |
17 | typedef struct { |
18 | void *add_arg; | |
19 | custom_ext_add_cb add_cb; | |
20 | custom_ext_free_cb free_cb; | |
21 | } custom_ext_add_cb_wrap; | |
22 | ||
23 | typedef struct { | |
24 | void *parse_arg; | |
25 | custom_ext_parse_cb parse_cb; | |
26 | } custom_ext_parse_cb_wrap; | |
27 | ||
28 | /* | |
29 | * Provide thin wrapper callbacks which convert new style arguments to old style | |
30 | */ | |
31 | static int custom_ext_add_old_cb_wrap(SSL *s, unsigned int ext_type, | |
32 | unsigned int context, | |
33 | const unsigned char **out, | |
34 | size_t *outlen, X509 *x, size_t chainidx, | |
35 | int *al, void *add_arg) | |
36 | { | |
37 | custom_ext_add_cb_wrap *add_cb_wrap = (custom_ext_add_cb_wrap *)add_arg; | |
38 | ||
39 | if (add_cb_wrap->add_cb == NULL) | |
40 | return 1; | |
41 | ||
42 | return add_cb_wrap->add_cb(s, ext_type, out, outlen, al, | |
43 | add_cb_wrap->add_arg); | |
44 | } | |
45 | ||
46 | static void custom_ext_free_old_cb_wrap(SSL *s, unsigned int ext_type, | |
47 | unsigned int context, | |
48 | const unsigned char *out, void *add_arg) | |
49 | { | |
50 | custom_ext_add_cb_wrap *add_cb_wrap = (custom_ext_add_cb_wrap *)add_arg; | |
51 | ||
52 | if (add_cb_wrap->free_cb == NULL) | |
53 | return; | |
54 | ||
55 | add_cb_wrap->free_cb(s, ext_type, out, add_cb_wrap->add_arg); | |
56 | } | |
57 | ||
58 | static int custom_ext_parse_old_cb_wrap(SSL *s, unsigned int ext_type, | |
59 | unsigned int context, | |
60 | const unsigned char *in, | |
61 | size_t inlen, X509 *x, size_t chainidx, | |
62 | int *al, void *parse_arg) | |
63 | { | |
64 | custom_ext_parse_cb_wrap *parse_cb_wrap = | |
65 | (custom_ext_parse_cb_wrap *)parse_arg; | |
66 | ||
e596c68c GE |
67 | if (parse_cb_wrap->parse_cb == NULL) |
68 | return 1; | |
69 | ||
43ae5eed MC |
70 | return parse_cb_wrap->parse_cb(s, ext_type, in, inlen, al, |
71 | parse_cb_wrap->parse_arg); | |
72 | } | |
73 | ||
74 | /* | |
787d9ec7 | 75 | * Find a custom extension from the list. The |role| param is there to |
43ae5eed | 76 | * support the legacy API where custom extensions for client and server could |
787d9ec7 MC |
77 | * be set independently on the same SSL_CTX. It is set to ENDPOINT_SERVER if we |
78 | * are trying to find a method relevant to the server, ENDPOINT_CLIENT for the | |
79 | * client, or ENDPOINT_BOTH for either | |
43ae5eed | 80 | */ |
787d9ec7 MC |
81 | custom_ext_method *custom_ext_find(const custom_ext_methods *exts, |
82 | ENDPOINT role, unsigned int ext_type, | |
83 | size_t *idx) | |
0f113f3e MC |
84 | { |
85 | size_t i; | |
86 | custom_ext_method *meth = exts->meths; | |
64350ab5 | 87 | |
0f113f3e | 88 | for (i = 0; i < exts->meths_count; i++, meth++) { |
43ae5eed | 89 | if (ext_type == meth->ext_type |
787d9ec7 MC |
90 | && (role == ENDPOINT_BOTH || role == meth->role |
91 | || meth->role == ENDPOINT_BOTH)) { | |
43ae5eed MC |
92 | if (idx != NULL) |
93 | *idx = i; | |
0f113f3e | 94 | return meth; |
43ae5eed | 95 | } |
0f113f3e MC |
96 | } |
97 | return NULL; | |
98 | } | |
99 | ||
100 | /* | |
101 | * Initialise custom extensions flags to indicate neither sent nor received. | |
28ea0a0c DSH |
102 | */ |
103 | void custom_ext_init(custom_ext_methods *exts) | |
0f113f3e MC |
104 | { |
105 | size_t i; | |
106 | custom_ext_method *meth = exts->meths; | |
64350ab5 | 107 | |
0f113f3e MC |
108 | for (i = 0; i < exts->meths_count; i++, meth++) |
109 | meth->ext_flags = 0; | |
110 | } | |
ecf4d660 | 111 | |
0cfefe4b | 112 | /* Pass received custom extension data to the application for parsing. */ |
38b051a1 TM |
113 | int custom_ext_parse(SSL_CONNECTION *s, unsigned int context, |
114 | unsigned int ext_type, | |
43ae5eed | 115 | const unsigned char *ext_data, size_t ext_size, X509 *x, |
f63a17d6 | 116 | size_t chainidx) |
0f113f3e | 117 | { |
f63a17d6 | 118 | int al; |
43ae5eed | 119 | custom_ext_methods *exts = &s->cert->custext; |
0f113f3e | 120 | custom_ext_method *meth; |
787d9ec7 | 121 | ENDPOINT role = ENDPOINT_BOTH; |
43ae5eed MC |
122 | |
123 | if ((context & (SSL_EXT_CLIENT_HELLO | SSL_EXT_TLS1_2_SERVER_HELLO)) != 0) | |
787d9ec7 | 124 | role = s->server ? ENDPOINT_SERVER : ENDPOINT_CLIENT; |
43ae5eed | 125 | |
787d9ec7 | 126 | meth = custom_ext_find(exts, role, ext_type, NULL); |
0f113f3e MC |
127 | /* If not found return success */ |
128 | if (!meth) | |
129 | return 1; | |
43ae5eed MC |
130 | |
131 | /* Check if extension is defined for our protocol. If not, skip */ | |
132 | if (!extension_is_relevant(s, meth->context, context)) | |
133 | return 1; | |
134 | ||
135 | if ((context & (SSL_EXT_TLS1_2_SERVER_HELLO | |
136 | | SSL_EXT_TLS1_3_SERVER_HELLO | |
137 | | SSL_EXT_TLS1_3_ENCRYPTED_EXTENSIONS)) != 0) { | |
0f113f3e | 138 | /* |
43ae5eed MC |
139 | * If it's ServerHello or EncryptedExtensions we can't have any |
140 | * extensions not sent in ClientHello. | |
0f113f3e | 141 | */ |
43ae5eed | 142 | if ((meth->ext_flags & SSL_EXT_FLAG_SENT) == 0) { |
c48ffbcc | 143 | SSLfatal(s, TLS1_AD_UNSUPPORTED_EXTENSION, SSL_R_BAD_EXTENSION); |
0f113f3e MC |
144 | return 0; |
145 | } | |
146 | } | |
43ae5eed MC |
147 | |
148 | /* | |
cbb862fb MC |
149 | * Extensions received in the ClientHello or CertificateRequest are marked |
150 | * with the SSL_EXT_FLAG_RECEIVED. This is so we know to add the equivalent | |
151 | * extensions in the response messages | |
43ae5eed | 152 | */ |
cbb862fb MC |
153 | if ((context & (SSL_EXT_CLIENT_HELLO | SSL_EXT_TLS1_3_CERTIFICATE_REQUEST)) |
154 | != 0) | |
43ae5eed MC |
155 | meth->ext_flags |= SSL_EXT_FLAG_RECEIVED; |
156 | ||
0f113f3e | 157 | /* If no parse function set return success */ |
38b051a1 | 158 | if (meth->parse_cb == NULL) |
0f113f3e | 159 | return 1; |
ecf4d660 | 160 | |
38b051a1 TM |
161 | if (meth->parse_cb(SSL_CONNECTION_GET_SSL(s), ext_type, context, ext_data, |
162 | ext_size, x, chainidx, &al, meth->parse_arg) <= 0) { | |
c48ffbcc | 163 | SSLfatal(s, al, SSL_R_BAD_EXTENSION); |
f63a17d6 MC |
164 | return 0; |
165 | } | |
166 | ||
167 | return 1; | |
0f113f3e | 168 | } |
ecf4d660 | 169 | |
2c7b4dbc MC |
170 | /* |
171 | * Request custom extension data from the application and add to the return | |
172 | * buffer. | |
173 | */ | |
38b051a1 TM |
174 | int custom_ext_add(SSL_CONNECTION *s, int context, WPACKET *pkt, X509 *x, |
175 | size_t chainidx, int maxversion) | |
2c7b4dbc | 176 | { |
43ae5eed | 177 | custom_ext_methods *exts = &s->cert->custext; |
2c7b4dbc MC |
178 | custom_ext_method *meth; |
179 | size_t i; | |
f63a17d6 | 180 | int al; |
72620ac7 | 181 | int for_comp = (context & SSL_EXT_TLS1_3_CERTIFICATE_COMPRESSION) != 0; |
2c7b4dbc MC |
182 | |
183 | for (i = 0; i < exts->meths_count; i++) { | |
184 | const unsigned char *out = NULL; | |
185 | size_t outlen = 0; | |
2c7b4dbc MC |
186 | |
187 | meth = exts->meths + i; | |
188 | ||
43ae5eed MC |
189 | if (!should_add_extension(s, meth->context, context, maxversion)) |
190 | continue; | |
191 | ||
192 | if ((context & (SSL_EXT_TLS1_2_SERVER_HELLO | |
193 | | SSL_EXT_TLS1_3_SERVER_HELLO | |
7f533d6f MC |
194 | | SSL_EXT_TLS1_3_ENCRYPTED_EXTENSIONS |
195 | | SSL_EXT_TLS1_3_CERTIFICATE | |
3c95ef22 | 196 | | SSL_EXT_TLS1_3_RAW_PUBLIC_KEY |
7f533d6f | 197 | | SSL_EXT_TLS1_3_HELLO_RETRY_REQUEST)) != 0) { |
cbb862fb | 198 | /* Only send extensions present in ClientHello/CertificateRequest */ |
2c7b4dbc MC |
199 | if (!(meth->ext_flags & SSL_EXT_FLAG_RECEIVED)) |
200 | continue; | |
2c7b4dbc | 201 | } |
43ae5eed MC |
202 | /* |
203 | * We skip it if the callback is absent - except for a ClientHello where | |
204 | * we add an empty extension. | |
205 | */ | |
206 | if ((context & SSL_EXT_CLIENT_HELLO) == 0 && meth->add_cb == NULL) | |
207 | continue; | |
208 | ||
209 | if (meth->add_cb != NULL) { | |
38b051a1 TM |
210 | int cb_retval = meth->add_cb(SSL_CONNECTION_GET_SSL(s), |
211 | meth->ext_type, context, &out, | |
f63a17d6 | 212 | &outlen, x, chainidx, &al, |
64350ab5 MC |
213 | meth->add_arg); |
214 | ||
f63a17d6 | 215 | if (cb_retval < 0) { |
72620ac7 TS |
216 | if (!for_comp) |
217 | SSLfatal(s, al, SSL_R_CALLBACK_FAILED); | |
2c7b4dbc | 218 | return 0; /* error */ |
f63a17d6 | 219 | } |
2c7b4dbc MC |
220 | if (cb_retval == 0) |
221 | continue; /* skip this extension */ | |
222 | } | |
223 | ||
08029dfa | 224 | if (!WPACKET_put_bytes_u16(pkt, meth->ext_type) |
de451856 | 225 | || !WPACKET_start_sub_packet_u16(pkt) |
0217dd19 MC |
226 | || (outlen > 0 && !WPACKET_memcpy(pkt, out, outlen)) |
227 | || !WPACKET_close(pkt)) { | |
72620ac7 TS |
228 | if (!for_comp) |
229 | SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR); | |
2c7b4dbc MC |
230 | return 0; |
231 | } | |
43ae5eed MC |
232 | if ((context & SSL_EXT_CLIENT_HELLO) != 0) { |
233 | /* | |
234 | * We can't send duplicates: code logic should prevent this. | |
235 | */ | |
b77f3ed1 | 236 | if (!ossl_assert((meth->ext_flags & SSL_EXT_FLAG_SENT) == 0)) { |
72620ac7 TS |
237 | if (!for_comp) |
238 | SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR); | |
b77f3ed1 MC |
239 | return 0; |
240 | } | |
43ae5eed MC |
241 | /* |
242 | * Indicate extension has been sent: this is both a sanity check to | |
243 | * ensure we don't send duplicate extensions and indicates that it | |
244 | * is not an error if the extension is present in ServerHello. | |
245 | */ | |
246 | meth->ext_flags |= SSL_EXT_FLAG_SENT; | |
247 | } | |
64350ab5 | 248 | if (meth->free_cb != NULL) |
38b051a1 TM |
249 | meth->free_cb(SSL_CONNECTION_GET_SSL(s), meth->ext_type, context, |
250 | out, meth->add_arg); | |
2c7b4dbc MC |
251 | } |
252 | return 1; | |
253 | } | |
254 | ||
21181889 MC |
255 | /* Copy the flags from src to dst for any extensions that exist in both */ |
256 | int custom_exts_copy_flags(custom_ext_methods *dst, | |
257 | const custom_ext_methods *src) | |
258 | { | |
259 | size_t i; | |
260 | custom_ext_method *methsrc = src->meths; | |
261 | ||
262 | for (i = 0; i < src->meths_count; i++, methsrc++) { | |
263 | custom_ext_method *methdst = custom_ext_find(dst, methsrc->role, | |
264 | methsrc->ext_type, NULL); | |
265 | ||
266 | if (methdst == NULL) | |
267 | continue; | |
268 | ||
269 | methdst->ext_flags = methsrc->ext_flags; | |
270 | } | |
271 | ||
272 | return 1; | |
273 | } | |
274 | ||
ecf4d660 | 275 | /* Copy table of custom extensions */ |
ecf4d660 | 276 | int custom_exts_copy(custom_ext_methods *dst, const custom_ext_methods *src) |
0f113f3e | 277 | { |
43ae5eed MC |
278 | size_t i; |
279 | int err = 0; | |
280 | ||
281 | if (src->meths_count > 0) { | |
0f113f3e | 282 | dst->meths = |
7644a9ae | 283 | OPENSSL_memdup(src->meths, |
64350ab5 | 284 | sizeof(*src->meths) * src->meths_count); |
0f113f3e MC |
285 | if (dst->meths == NULL) |
286 | return 0; | |
287 | dst->meths_count = src->meths_count; | |
43ae5eed MC |
288 | |
289 | for (i = 0; i < src->meths_count; i++) { | |
290 | custom_ext_method *methsrc = src->meths + i; | |
291 | custom_ext_method *methdst = dst->meths + i; | |
292 | ||
293 | if (methsrc->add_cb != custom_ext_add_old_cb_wrap) | |
294 | continue; | |
295 | ||
296 | /* | |
297 | * We have found an old style API wrapper. We need to copy the | |
298 | * arguments too. | |
299 | */ | |
300 | ||
301 | if (err) { | |
302 | methdst->add_arg = NULL; | |
303 | methdst->parse_arg = NULL; | |
304 | continue; | |
305 | } | |
306 | ||
307 | methdst->add_arg = OPENSSL_memdup(methsrc->add_arg, | |
308 | sizeof(custom_ext_add_cb_wrap)); | |
309 | methdst->parse_arg = OPENSSL_memdup(methsrc->parse_arg, | |
310 | sizeof(custom_ext_parse_cb_wrap)); | |
311 | ||
312 | if (methdst->add_arg == NULL || methdst->parse_arg == NULL) | |
313 | err = 1; | |
314 | } | |
315 | } | |
316 | ||
317 | if (err) { | |
318 | custom_exts_free(dst); | |
319 | return 0; | |
0f113f3e | 320 | } |
43ae5eed | 321 | |
0f113f3e MC |
322 | return 1; |
323 | } | |
ecf4d660 DSH |
324 | |
325 | void custom_exts_free(custom_ext_methods *exts) | |
0f113f3e | 326 | { |
43ae5eed | 327 | size_t i; |
64350ab5 | 328 | custom_ext_method *meth; |
43ae5eed | 329 | |
64350ab5 | 330 | for (i = 0, meth = exts->meths; i < exts->meths_count; i++, meth++) { |
43ae5eed MC |
331 | if (meth->add_cb != custom_ext_add_old_cb_wrap) |
332 | continue; | |
333 | ||
334 | /* Old style API wrapper. Need to free the arguments too */ | |
335 | OPENSSL_free(meth->add_arg); | |
336 | OPENSSL_free(meth->parse_arg); | |
337 | } | |
b548a1f1 | 338 | OPENSSL_free(exts->meths); |
0f113f3e | 339 | } |
ecf4d660 | 340 | |
43ae5eed MC |
341 | /* Return true if a client custom extension exists, false otherwise */ |
342 | int SSL_CTX_has_client_custom_ext(const SSL_CTX *ctx, unsigned int ext_type) | |
0f113f3e | 343 | { |
787d9ec7 MC |
344 | return custom_ext_find(&ctx->cert->custext, ENDPOINT_CLIENT, ext_type, |
345 | NULL) != NULL; | |
43ae5eed MC |
346 | } |
347 | ||
f6da3bbf MC |
348 | int ossl_tls_add_custom_ext_intern(SSL_CTX *ctx, custom_ext_methods *exts, |
349 | ENDPOINT role, unsigned int ext_type, | |
350 | unsigned int context, | |
351 | SSL_custom_ext_add_cb_ex add_cb, | |
352 | SSL_custom_ext_free_cb_ex free_cb, | |
353 | void *add_arg, | |
354 | SSL_custom_ext_parse_cb_ex parse_cb, | |
355 | void *parse_arg) | |
43ae5eed | 356 | { |
7c0ef843 | 357 | custom_ext_method *meth, *tmp; |
43ae5eed | 358 | |
0f113f3e MC |
359 | /* |
360 | * Check application error: if add_cb is not set free_cb will never be | |
361 | * called. | |
362 | */ | |
64350ab5 | 363 | if (add_cb == NULL && free_cb != NULL) |
0f113f3e | 364 | return 0; |
43ae5eed | 365 | |
f6da3bbf MC |
366 | if (exts == NULL) |
367 | exts = &ctx->cert->custext; | |
368 | ||
43ae5eed MC |
369 | #ifndef OPENSSL_NO_CT |
370 | /* | |
371 | * We don't want applications registering callbacks for SCT extensions | |
372 | * whilst simultaneously using the built-in SCT validation features, as | |
373 | * these two things may not play well together. | |
374 | */ | |
375 | if (ext_type == TLSEXT_TYPE_signed_certificate_timestamp | |
376 | && (context & SSL_EXT_CLIENT_HELLO) != 0 | |
f6da3bbf | 377 | && ctx != NULL |
43ae5eed MC |
378 | && SSL_CTX_ct_is_enabled(ctx)) |
379 | return 0; | |
380 | #endif | |
381 | ||
ed29e82a RP |
382 | /* |
383 | * Don't add if extension supported internally, but make exception | |
384 | * for extension types that previously were not supported, but now are. | |
385 | */ | |
43ae5eed MC |
386 | if (SSL_extension_supported(ext_type) |
387 | && ext_type != TLSEXT_TYPE_signed_certificate_timestamp) | |
0f113f3e | 388 | return 0; |
43ae5eed | 389 | |
0f113f3e MC |
390 | /* Extension type must fit in 16 bits */ |
391 | if (ext_type > 0xffff) | |
392 | return 0; | |
393 | /* Search for duplicate */ | |
787d9ec7 | 394 | if (custom_ext_find(exts, role, ext_type, NULL)) |
0f113f3e | 395 | return 0; |
7c0ef843 DSH |
396 | tmp = OPENSSL_realloc(exts->meths, |
397 | (exts->meths_count + 1) * sizeof(custom_ext_method)); | |
ed874fac | 398 | if (tmp == NULL) |
0f113f3e | 399 | return 0; |
ecf4d660 | 400 | |
7c0ef843 | 401 | exts->meths = tmp; |
0f113f3e | 402 | meth = exts->meths + exts->meths_count; |
16f8d4eb | 403 | memset(meth, 0, sizeof(*meth)); |
787d9ec7 | 404 | meth->role = role; |
43ae5eed | 405 | meth->context = context; |
0f113f3e MC |
406 | meth->parse_cb = parse_cb; |
407 | meth->add_cb = add_cb; | |
408 | meth->free_cb = free_cb; | |
409 | meth->ext_type = ext_type; | |
410 | meth->add_arg = add_arg; | |
411 | meth->parse_arg = parse_arg; | |
412 | exts->meths_count++; | |
413 | return 1; | |
414 | } | |
ecf4d660 | 415 | |
787d9ec7 MC |
416 | static int add_old_custom_ext(SSL_CTX *ctx, ENDPOINT role, |
417 | unsigned int ext_type, | |
43ae5eed MC |
418 | unsigned int context, |
419 | custom_ext_add_cb add_cb, | |
420 | custom_ext_free_cb free_cb, | |
421 | void *add_arg, | |
422 | custom_ext_parse_cb parse_cb, void *parse_arg) | |
ed29e82a | 423 | { |
43ae5eed | 424 | custom_ext_add_cb_wrap *add_cb_wrap |
64350ab5 | 425 | = OPENSSL_malloc(sizeof(*add_cb_wrap)); |
43ae5eed | 426 | custom_ext_parse_cb_wrap *parse_cb_wrap |
64350ab5 | 427 | = OPENSSL_malloc(sizeof(*parse_cb_wrap)); |
43ae5eed MC |
428 | int ret; |
429 | ||
430 | if (add_cb_wrap == NULL || parse_cb_wrap == NULL) { | |
431 | OPENSSL_free(add_cb_wrap); | |
432 | OPENSSL_free(parse_cb_wrap); | |
433 | return 0; | |
434 | } | |
435 | ||
436 | add_cb_wrap->add_arg = add_arg; | |
437 | add_cb_wrap->add_cb = add_cb; | |
438 | add_cb_wrap->free_cb = free_cb; | |
439 | parse_cb_wrap->parse_arg = parse_arg; | |
440 | parse_cb_wrap->parse_cb = parse_cb; | |
441 | ||
f6da3bbf MC |
442 | ret = ossl_tls_add_custom_ext_intern(ctx, NULL, role, ext_type, |
443 | context, | |
444 | custom_ext_add_old_cb_wrap, | |
445 | custom_ext_free_old_cb_wrap, | |
446 | add_cb_wrap, | |
447 | custom_ext_parse_old_cb_wrap, | |
448 | parse_cb_wrap); | |
43ae5eed MC |
449 | |
450 | if (!ret) { | |
451 | OPENSSL_free(add_cb_wrap); | |
452 | OPENSSL_free(parse_cb_wrap); | |
453 | } | |
454 | ||
455 | return ret; | |
ed29e82a RP |
456 | } |
457 | ||
43ae5eed | 458 | /* Application level functions to add the old custom extension callbacks */ |
8cafe9e8 | 459 | int SSL_CTX_add_client_custom_ext(SSL_CTX *ctx, unsigned int ext_type, |
0f113f3e MC |
460 | custom_ext_add_cb add_cb, |
461 | custom_ext_free_cb free_cb, | |
0cfefe4b | 462 | void *add_arg, |
a230b26e | 463 | custom_ext_parse_cb parse_cb, void *parse_arg) |
0f113f3e | 464 | { |
787d9ec7 | 465 | return add_old_custom_ext(ctx, ENDPOINT_CLIENT, ext_type, |
43ae5eed MC |
466 | SSL_EXT_TLS1_2_AND_BELOW_ONLY |
467 | | SSL_EXT_CLIENT_HELLO | |
468 | | SSL_EXT_TLS1_2_SERVER_HELLO | |
469 | | SSL_EXT_IGNORE_ON_RESUMPTION, | |
470 | add_cb, free_cb, add_arg, parse_cb, parse_arg); | |
0f113f3e | 471 | } |
ecf4d660 | 472 | |
8cafe9e8 | 473 | int SSL_CTX_add_server_custom_ext(SSL_CTX *ctx, unsigned int ext_type, |
0f113f3e MC |
474 | custom_ext_add_cb add_cb, |
475 | custom_ext_free_cb free_cb, | |
0cfefe4b | 476 | void *add_arg, |
a230b26e | 477 | custom_ext_parse_cb parse_cb, void *parse_arg) |
0f113f3e | 478 | { |
787d9ec7 | 479 | return add_old_custom_ext(ctx, ENDPOINT_SERVER, ext_type, |
43ae5eed MC |
480 | SSL_EXT_TLS1_2_AND_BELOW_ONLY |
481 | | SSL_EXT_CLIENT_HELLO | |
482 | | SSL_EXT_TLS1_2_SERVER_HELLO | |
483 | | SSL_EXT_IGNORE_ON_RESUMPTION, | |
484 | add_cb, free_cb, add_arg, parse_cb, parse_arg); | |
485 | } | |
486 | ||
487 | int SSL_CTX_add_custom_ext(SSL_CTX *ctx, unsigned int ext_type, | |
488 | unsigned int context, | |
cd17bb19 MC |
489 | SSL_custom_ext_add_cb_ex add_cb, |
490 | SSL_custom_ext_free_cb_ex free_cb, | |
43ae5eed | 491 | void *add_arg, |
cd17bb19 | 492 | SSL_custom_ext_parse_cb_ex parse_cb, void *parse_arg) |
43ae5eed | 493 | { |
f6da3bbf MC |
494 | return ossl_tls_add_custom_ext_intern(ctx, NULL, ENDPOINT_BOTH, ext_type, |
495 | context, add_cb, free_cb, add_arg, | |
496 | parse_cb, parse_arg); | |
0f113f3e | 497 | } |
c846a5f5 DSH |
498 | |
499 | int SSL_extension_supported(unsigned int ext_type) | |
0f113f3e MC |
500 | { |
501 | switch (ext_type) { | |
502 | /* Internally supported extensions. */ | |
503 | case TLSEXT_TYPE_application_layer_protocol_negotiation: | |
504 | case TLSEXT_TYPE_ec_point_formats: | |
de4d764e | 505 | case TLSEXT_TYPE_supported_groups: |
36abb6a2 | 506 | case TLSEXT_TYPE_key_share: |
1595ca02 | 507 | #ifndef OPENSSL_NO_NEXTPROTONEG |
0f113f3e | 508 | case TLSEXT_TYPE_next_proto_neg: |
1595ca02 | 509 | #endif |
0f113f3e MC |
510 | case TLSEXT_TYPE_padding: |
511 | case TLSEXT_TYPE_renegotiate: | |
cf72c757 | 512 | case TLSEXT_TYPE_max_fragment_length: |
0f113f3e MC |
513 | case TLSEXT_TYPE_server_name: |
514 | case TLSEXT_TYPE_session_ticket: | |
515 | case TLSEXT_TYPE_signature_algorithms: | |
36abb6a2 | 516 | #ifndef OPENSSL_NO_SRP |
0f113f3e | 517 | case TLSEXT_TYPE_srp: |
36abb6a2 MC |
518 | #endif |
519 | #ifndef OPENSSL_NO_OCSP | |
0f113f3e | 520 | case TLSEXT_TYPE_status_request: |
36abb6a2 MC |
521 | #endif |
522 | #ifndef OPENSSL_NO_CT | |
ed29e82a | 523 | case TLSEXT_TYPE_signed_certificate_timestamp: |
36abb6a2 MC |
524 | #endif |
525 | #ifndef OPENSSL_NO_SRTP | |
0f113f3e | 526 | case TLSEXT_TYPE_use_srtp: |
e481f9b9 | 527 | #endif |
36abb6a2 | 528 | case TLSEXT_TYPE_encrypt_then_mac: |
91b60e2a MC |
529 | case TLSEXT_TYPE_supported_versions: |
530 | case TLSEXT_TYPE_extended_master_secret: | |
36abb6a2 MC |
531 | case TLSEXT_TYPE_psk_kex_modes: |
532 | case TLSEXT_TYPE_cookie: | |
533 | case TLSEXT_TYPE_early_data: | |
534 | case TLSEXT_TYPE_certificate_authorities: | |
535 | case TLSEXT_TYPE_psk: | |
9d75dce3 | 536 | case TLSEXT_TYPE_post_handshake_auth: |
b67cb09f | 537 | case TLSEXT_TYPE_compress_certificate: |
3c95ef22 TS |
538 | case TLSEXT_TYPE_client_cert_type: |
539 | case TLSEXT_TYPE_server_cert_type: | |
0f113f3e MC |
540 | return 1; |
541 | default: | |
542 | return 0; | |
543 | } | |
544 | } |